#!/bin/bash

echo '...........................'
echo '...........................'
echo "正在执行操作系统版本判断，请稍后............." && sleep 5
#rpm包手动下载 https://mirrors.cloud.tencent.com/centos

v=`cat /etc/redhat-release|sed -r 's/.* ([0-9]+)\..*/\1/'`
if [ $v -eq 6 ]; then
    rpm -ivh https://mirrors.cloud.tencent.com/centos/6/os/x86_64/Packages/wget-1.12-10.el6.x86_64.rpm
    mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
    mv /etc/yum.repos.d/media.repo /etc/yum.repos.d/media.repo.backup
    wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.cloud.tencent.com/repo/centos6_base.repo
    sed -i 's#http#https#g' /etc/yum.repos.d/CentOS-Base.repo
    yum clean all
    yum makecache

elif [ $v -eq 7 ]; then
    rpm -ivh https://mirrors.cloud.tencent.com/centos/7/os/x86_64/Packages/wget-1.14-18.el7_6.1.x86_64.rpm
    mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
    wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.cloud.tencent.com/repo/centos7_base.repo
    sed -i 's#http#https#g' /etc/yum.repos.d/CentOS-Base.repo
    yum clean all
    yum makecache

elif [ $v -eq 8 ]; then
    rpm -ivh https://mirrors.cloud.tencent.com/centos/8.4.2105/AppStream/x86_64/os/Packages/wget-1.19.5-10.el8.x86_64.rpm
    mv /etc/yum.repos.d/CentOS-Base.repo /etc/yum.repos.d/CentOS-Base.repo.backup
    wget -O /etc/yum.repos.d/CentOS-Base.repo http://mirrors.cloud.tencent.com/repo/centos8_base.repo
    sed -i 's#http#https#g' /etc/yum.repos.d/CentOS-Base.repo
    yum clean all
    yum makecache
else 
    echo "其他操作系统暂未支持，请联系维护人员升级！"
    exit 0
fi
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/sysconfig/selinux
setenforce 0

echo '...........................'
echo '...........................'
echo "正在执行系统依赖包检查，请稍后............." && sleep 5

#保证yum执行不报错，才能完成下面依赖命令顺利完成！
yum install  -y gcc gcc-c++ glibc make autoconf openssl openssl-devel pcre-devel  pam-devel  rpm-build perl
yum install -y zlib-devel  #>/dev/null 2>&1
yum install  pam-devel    keyutils-libs libcom_err-devel libselinux-devel libsepol-devel -y #>/dev/null 2>&1

echo '...........................'
echo '...........................'
echo "下载最新openssh，请稍后............." && sleep 5
#新版本openssh下载地址：https://cloudflare.cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/, 如果有最新版本，替换下面最新版本即可。
if command -v wget >/dev/null 2>&1; then
    cd /tmp
    wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz
else 
    yum install wget
    cd /tmp
    wget https://cdn.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-9.8p1.tar.gz
fi


echo '...........................'
echo '...........................'
echo "删除低版本OpenSSH rpm包，请稍后............." && sleep 5
rpm -e --nodeps `rpm -qa | grep openssh` 
rpm -e openssh-server --nodeps
rpm -e openssh-clients --nodeps
rpm -e openssh-askpass
service sshd stop
rm -rf /etc/ssh/*



echo '...........................'
echo '...........................'
echo "openssh压缩包解压，请稍后............." && sleep 5
cd /tmp
tar -zxvf openssh-9.8p1.tar.gz
cd openssh-9.8p1
mv /etc/ssh /etc/ssh_bak
chown -R root.root /tmp/openssh-9.8p1

echo '...........................'
echo '...........................'
echo "准备进行openssh安装，请稍后............." && sleep 5
if [ $v -eq 6 ]; then
    echo '编译ssh中..................'
    echo '...........................'
    echo '...........................'
    wget https://www.openssl.org/source/openssl-1.1.1g.tar.gz  /usr/local/src/
    cd /usr/local/src/
    tar -zxf openssl-1.1.1g.tar.gz
    cd /usr/local/src/openssl-1.1.1g
    ./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl --shared zlib && make && make install
    mv /usr/bin/openssl /usr/bin/openssl_1.0.1e_bak
    cp /usr/local/openssl/bin/openssl /usr/bin/openssl
    openssl 
    ldd `which openssl`
    cp /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/
    cp /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/
    cd /usr/local/openssl/lib
    cat /etc/ld.so.conf
    echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
    ldconfig
    ldconfig -v
    cd /tmp/openssh-9.8p1/
    ./configure --prefix=/usr --sysconfdir=/etc/ssh --with-pam --with-zlib --with-md5-passwords --with-tcp-wrappers  && make && make install
    if [ $? -eq 0 ]; then
        echo '编译ssh完成！'
        #mv /etc/ssh/sshd_config  /etc/ssh/sshd_config.bak
        #cp -a /tmp/openssh-9.8p1/sshd_config /etc/ssh/sshd_config
        chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
    else 
        echo "编译错误请检查日志！"
        exit 0
    fi
elif [ $v -eq 7 ]; then
    echo '编译ssl中..................'
    echo '...........................'
    echo '...........................'
    cd /usr/local/src/
    wget https://www.openssl.org/source/openssl-1.1.1d.tar.gz  /usr/local/src/ 
    tar -zxf openssl-1.1.1d.tar.gz
    cd /usr/local/src/openssl-1.1.1d
    ./config --prefix=/usr/local/openssl --openssldir=/usr/local/openssl --shared zlib && make && make install
    mv /usr/bin/openssl /usr/bin/openssl_1.0.1e_bak
    cp /usr/local/openssl/bin/openssl /usr/bin/openssl
    #openssl 
    #ldd `which openssl`
    cp /usr/local/openssl/lib/libssl.so.1.1 /usr/lib64/
    cp /usr/local/openssl/lib/libcrypto.so.1.1 /usr/lib64/
    cd /usr/local/openssl/lib
    cat /etc/ld.so.conf
    echo "/usr/local/openssl/lib" >> /etc/ld.so.conf
    ldconfig
    ldconfig -v
    sleep 5

    #编译ssh
    cd /tmp/openssh-9.8p1
    echo '编译ssh中..................'
    echo '...........................'
    echo '...........................'
    #yum update openssh
    ./configure --prefix=/usr/ --sysconfdir=/etc/ssh --with-pam --with-md5-passwords --with-zlib && make && make install
    if [ $? -eq 0 ]; then
        echo '编译ssh完成！'
        #mv /etc/ssh/sshd_config  /etc/ssh/sshd_config.bak
        #cp -a /tmp/openssh-9.8p1/sshd_config /etc/ssh/sshd_config
        chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
    else
        echo "编译错误请检查日志！"
        exit 0
    fi

elif [ $v -eq 8 ]; then
    echo '编译ssh中..................'
    echo '...........................'
    echo '...........................'
    yum update openssh
    ./configure   --prefix=/usr   --sysconfdir=/etc/ssh    --with-md5-passwords   --with-pam --with-zlib   --with-tcp-wrappers    --with-ssl-dir=/usr/local/ssl   --without-hardening && make && make install
    if [ $? -eq 0 ]; then
        echo '编译ssh完成！'
        #mv /etc/ssh/sshd_config  /etc/ssh/sshd_config.bak
        #cp -a /tmp/openssh-9.8p1/sshd_config /etc/ssh/sshd_config
        chmod 600 /etc/ssh/ssh_host_rsa_key /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key
    else
        echo "编译错误请检查日志！" 
        exit 0
    fi
else 
    echo "其他操作系统暂未支持，请联系维护人员升级！"
    exit 0
fi

echo '...........................'
echo '...........................'
echo "修改配置文件/etc/ssh/sshd_config，请稍后............." && sleep 5
sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPICleanupCredentials/s/GSSAPICleanupCredentials yes/#GSSAPICleanupCredentials yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication yes/#GSSAPIAuthentication yes/' /etc/ssh/sshd_config
sed -i '/^GSSAPIAuthentication/s/GSSAPIAuthentication no/#GSSAPIAuthentication no/' /etc/ssh/sshd_config
sed -i 's/#UsePAM no/UsePAM no/g' /etc/ssh/sshd_config


echo '...........................'
echo '...........................'
echo "添加自动启动项，请稍后............." && sleep 5
if [ $v -eq 6 ]; then
    cd /tmp/openssh-9.8p1
    cp -a /tmp/openssh-9.8p1/contrib/redhat/sshd.init /etc/init.d/sshd
    cp -a /tmp/openssh-9.8p1/contrib/redhat/sshd.pam /etc/pam.d/sshd.pam
    cp -a /tmp/openssh-9.8p1/sshd /usr/sbin/sshd
    chmod +x /etc/init.d/sshd
    chkconfig --add sshd
    chkconfig sshd on
    service sshd restart
    
elif [ $v -eq 7 ]; then
    cd /tmp/openssh-9.8p1
    cp -a /tmp/openssh-9.8p1/contrib/redhat/sshd.init /etc/init.d/sshd
    cp -a /tmp/openssh-9.8p1/sshd /usr/sbin/sshd
    chmod +x /etc/init.d/sshd
    systemctl enable sshd
    systemctl restart sshd

elif [ $v -eq 8 ]; then
    cd /tmp/openssh-9.8p1
    cp -a /tmp/openssh-9.8p1/contrib/redhat/sshd.init /etc/init.d/sshd
    cp -a /tmp/openssh-9.8p1/sshd /usr/sbin/sshd
    chmod +x /etc/init.d/sshd
    systemctl enable sshd
    systemctl restart sshd

else
    echo "其他操作系统暂未支持，请联系维护人员升级！"
    exit
fi

#make uninstall卸载编译安装,失败回退旧版yum install -y openssh-server openssh-clients
if command -v ssh -V >/dev/null 2>&1; then
    echo 'openssh升级成功！'
    ssh -V
else
    echo 'openssh升级失败，请检查日志！'
fi